Spyware Warrior

[webhelper]

New Transponder variant via mypctuneup.com: KillPoll.exe

Now if users have one of the transponder variants (most likely twaintech.dll) installed and use their mypctuneup.com services which emails you an ID that is good for only 2 or 3 times and only removes the BHO registry entry and not the files or other registery entries, it now turns around and drops a new file dated 6/2/04:
KillPoll.cab which contains:
killpoll.exe
killpoll.inf

The killpoll.exe is one of their thinstaller files. So far it doesn't bring down other files and is deleted upon rebooting the computer which means they are in the process of possibly generating a newer dll or maybe their flop the voiceip.dll that has never transmitted correctly and was changed back to the twaintech.dll variant.

Only time will tell and I will probably tell on them before they can get the next one off the ground.
_________________
Wächter der Geschichten:
http://www.webhelper4u.com/thewatcher.html
Member of ASAP Since 2004